Summary
Contao, a PHP-based content management system, has fixed a critical cross-site scripting vulnerability in its comments bundle that exposed site admini…
The vulnerability, CVE-2026-107845, carries a severity score of 9.3 out of 10. An unauthenticated visitor could post a comment carrying a script injection, and the script would execute in the Contao back end, in the session of whichever administrator or editor opened the Comments module. Because moderating comments is routine work, exposure was likely rather than theoretical, and the Contao back end does not send a Content-Security-Policy header that might have limited the impact.
Site owners should upgrade the contao/comments-bundle package to version 5.3.50 or 5.7.12, depending on their Contao branch. Until the update is applied, administrators should treat unexpected comments as untrusted content and avoid opening the Comments module on production sites.
Source: GitHub Security Advisories
